Aug 2026· Periodica Polytechnica Electrical Engineering and Computer Science· 0 citations
TL;DR
This work proposes Residual GRU-Attention Anomaly Detector (RGAAD), an unsupervised framework for IoT time-series anomaly detection that achieves highly competitive performance and consistently outperforms strong baseline methods.
Abstract
The rapid growth of Internet of Things (IoT) systems has generated massive, complex, and highly dynamic time-series data, making anomaly detection essential for system security and operational stability. However, traditional methods based on pointwise representations, statistical thresholds, or simple pairwise associations often struggle to capture complex temporal dependencies and feature interactions in IoT data. To address these challenges, we propose Residual GRU-Attention Anomaly Detector (RGAAD), an unsupervised framework for IoT time-series anomaly detection. RGAAD integrates residual GRU modeling, adaptive self-attention, and gated multi-scale feature fusion to jointly capture temporal dependencies and feature correlations. Extensive experiments on SMD, SWaT, and MSL demonstrate that RGAAD achieves highly competitive performance and consistently outperforms strong baseline methods. These results confirm that explicitly modeling pointwise anomalies and temporal relationships is effective for real-world IoT monitoring.
Detailed experimental evaluations demonstrate that deep neural models significantly outperform traditional machine learning approaches in terms of detection accuracy, false positive reduction, and scalability, and the suitability of deep learning-based anomaly detection systems for securing next-generation IoT networks while maintaining operational efficiency.
O. Adeyemi, F. Adebayo, Ibrahim Bello· International Journal of App...· 0 citations
Networked systems continuously generate heterogeneous time series, including Key Performance Indicator (KPI) streams, logs, and spectrum measurements, whose interpretation is essential for automated monitoring, diagnosis, and control. Existing analysis approaches either rely heavily on labeled data specific to each deployment or fail to capture joint time-domain and frequency-domain characteristics that are common in communication signals. Motivated by these limitations for cognitive communications and network monitoring, we propose the Time-Frequency Multi-Task Network (TFMTNet), a self-supervised framework that provides a transferable representation module for the evaluated network telemetry tasks. TFMTNet integrates a multi-scale time-frequency fusion backbone with three complementary pretraining objectives and provides lightweight task heads for anomaly detection, forecasting, and classification. Under a pretraining and adaptation protocol, the model is pretrained once and then adapted to target domains with limited labeled data. Empirical evaluation on ten anomaly detection datasets and additional public classification and forecasting datasets, including an Artificial Intelligence for IT Operations (AIOps) telemetry dataset, shows consistent cross-domain improvements under the evaluated settings. For cognitive communications, TFMTNet learns representations that can feed downstream reasoning and control modules, including Software-Defined Networking (SDN) decision making, spectrum management, and AIOps pipelines, thereby supporting the perception, reasoning, and control loop in networked systems.
Qi Qi, Chengsen Wang, Xingyue Wang et al.· IEEE Transactions on Cogniti...· 0 citations
The study introduces the Hybrid Anomaly-Filtered Spatio-Temporal Representation Network (HASTRN) to achieve accurate forecasting of short-term and day-ahead energy demand by utilizing smart-meter, solar PV, and weather-integrated data. Energy demand forecasting in residential buildings has become increasingly difficult due to varying loading patterns, solar irregularities, and the complexity of nonlinear relationships that exist between energy consumption and weather parameters. Conventional statistical and AI-based models have demonstrated a low capacity for managing anomalies, missing values, and temporal dependencies in the long run. To overcome these issues, the present paper creates a new hybrid approach to the problem, which combines multi-stage anomaly detection (Z-score, IQR, sliding-window), the Hybrid Correlation SVM Feature-Optimization Technique (HCSFOT) to perform advanced feature engineering, and a unified Deep Adaptive Spatio-Temporal Learning Network (DASTLN) network, which a combined Deep Neural Network (DNN), Artificial Neural Network (ANN), and Long Short-Term Memory (LSTM) architecture to predict the energy demand. The data acquisition, preprocessing, feature optimization, development of hybrid models, and multi-horizon forecasting are the workflow components. The hierarchical nonlinear interactions, instantaneous load variations, and long-range temporal trends are well represented by the proposed HASTRN model. From the experiments’ outcomes, one can clearly see the superiority of the forecasting approach with respect to RMSE, MAE, MAPE, R2 and solar variance metrics, indicating the effectiveness of the suggested HASTRN algorithm. The anticipated results are an increased stability of forecasting in the case of intermittency due to the sun, increased robustness in the presence of missing data, and an improved ability to manage the grid. The results make the HASTRN a good candidate for the next generations of smart energy-management systems.
G. S. Bibin, H. Vennila, M. Chinchu· Applied Sciences· 0 citations
Anomaly detection of sensors within small hardware platforms such as ESP32 is complicated by its lack of memory space and computational capabilities. This paper presents a lightweight anomaly detection model that uses autoencoders, developed and optimized using the TensorFlow Lite Micro framework. The model was trained based solely on normal readings of the sensors without any anomalies in order to deploy it to the ESP32. Additional features were introduced to enhance the performance of anomaly detection, such as motion magnitude (orientation-independent feature) and time of day. In contrast to other approaches, we use the 90th percentile of the reconstruction error to establish the anomaly threshold rather than a commonly used mean-plus-standard deviation technique. Tests on the anomaly detection algorithm using a portion of a big IoT data set having more than 50 thousand samples revealed the accuracy level to be 96.4%, recall rate as 43.29%, precision 31.56%, and the F1-score value of 36.5%. It clearly shows the performance was considerably higher compared to the baseline method that used the fixed threshold value. The same system was further evaluated using an actual ESP32 microcontroller board installed with the PIR sensor, MQ-2 gas sensor, and DHT22 sensor. In all cases, it correctly identified all five faults in a single inference run without generating any false positives for 10 minutes of operation time.
L. L, K. N, A. B· 2026 4th International Confe...· 0 citations
The CPS, in combination with the IoT sensor networks, has experienced massive growth, which results in massive data generation per second that presents extreme challenges to latency, scalability, and efficient data processing. The current paper presents a cloud-edge-integrated machine learning system for real-time monitoring of CPS environments. The suggested system combines IoT data collection, edge processing, and cloud-based model optimisation to enable fast, intelligent decision-making. Edge computing reduces communication overhead by performing local inference, while the cloud provides large-scale analytics and model training. The evaluation of the framework is conducted on a dataset of 10,000 sensor records that represent industrial parameters such as temperature, pressure, and vibration. The experimental findings showed that prediction accuracy was 91.2%, processing efficiency was 88.5%, and stability was 0.86, with a much lower latency of 205 ms. The overall performance index of 0.88 indicates that the computer's responsiveness, scalability, and efficiency have improved equally. The comparative analysis demonstrates that the proposed approach is significantly superior to traditional and standalone machine learning models, which is why it can be widely applied in real-time CPS monitoring applications.
Jayan Sharma· International Journal on Eng...· 0 citations
The rapid proliferation of Internet of Things (IoT) devices and their integration into increasingly interconnected applications have substantially expanded the attack surface of modern networked systems. The heterogeneous nature and high volume of IoT traffic make timely and reliable identification of malicious activities increasingly important for maintaining the security and resilience of IoT-enabled environments. This study investigates the effectiveness of maching learning approaches for supervised malicious traffic classification in IoT networks using the ACI-IoT-2023 dataset. A comparative experimental study is conducted across binary and eleven-class classification tasks to examine the capability of different learning approaches to distinguish benign and malicious traffic and identify diverse attack categories. The results demonstrate strong classification performance across the evaluated approaches, with XGBoost achieving the highest ROC-AUC in binary classification and the Decision Tree delivering the best overall performance in eleven-class classification. Further analysis of feature importance identifies several flow-level features that contribute substantially to classification performance. Overall, the findings demonstrate the effectiveness of machine learning-based approaches for accurate and efficient malicious traffic classification in IoT networks.
Connor Gladish, Molly Corgan, J. Moss et al.· Electronics· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
